# All Questions

19,124 questions
101 views

### Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
24 views

### How can I combine Quorum and Zero Knowledge Range Proofs

I have 20 years of experience at java JEE coding, and 10 years in devops as well, but no experience with blockchains, or the Go language. I want to setup a cluster of Quorum blockchain nodes, ...
64 views

### How does ECDHE fit with AES and SHA?

Hi I'm trying to piece together how AES, ECDHE, and SHA all work together. From what I understand ECDHE is uses asymmetric cryptography to generate a shared key from a public and private key which are ...
34 views

### Riemann's Hypothesis and Miller-Rabin test for primality [closed]

please what is the complexity of Miller Rabin the case we accept Hypothesis of Riemann
32 views

### How to prove element equality in G1 using Groth-Sahai proofs

In the BeleniosRF e-voting scheme, Groth-Sahai proofs with the "Instantiation based on the SXDH assumption" are used (see https://eprint.iacr.org/2007/155, version 20160411:065033, page 24). In the ...
50 views

### Block Cipher CTR mode when offset is not known by receiver

When an encrypted message is received, it can be easily decrypted if the offset (=counter) of the received message is known (and also the required private key of course). This allows for random access ...
27 views

### Why do we approximate R-1 rounds during linear or differential cryptanalysis?

I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ? I have ...
56 views

### Apple CryptoKit - Understanding its portability

I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language). I'm interested to see how portable it is.....
33 views

### Gennaro multi trapdoor commitment scheme

In the Scheme Based on the SDH Assumption (page 11 of the paper https://link.springer.com/content/pdf/10.1007%2F978-3-540-28628-8_14.pdf), how does the commitment get revealed with the master trapdoor ...
49 views

### DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
60 views

### How to find the key of XOR encryption in Java?

I am trying to find the key of an XOR-encrypted string in Java. It is very probable that the key is eight characters long. I have the encrypted string. I do not understand how to go backwards and ...
23 views

### How do BLS signatures prove a private key belongs to public key

In a Boneh-Lynn-Shacham sig the public key: Each of our devices has a signer’s number i = 1,2,3 that represent its place in a set, a private key pki and a corresponding public key Pi = pki×G. ...
35 views

### Are the factors for a number n, more likely to lie within a certain range of n?

Given $n=ab$ is $a$ or $b$ more likely to be between $1$ and $n/2$ as an example? Where $a$ and $b$ are prime
68 views

### Multivariate Cryptography: Security of the affine transform T

In this question, I'd like to discuss the security of the last transformation $T$ employed in the construction of a MV-scheme. MVCrypto is based on solving a system of polynomial equations, but ...
48 views

### Valid private keys on curve25519

Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
53 views

### AES with no SubByte - recover the key

I was wondering if it was possible to recover an AES-128 blockcipher key, knowing that there is no substitution box (it can be seen as the identity mapping). I thought it would be feasible. I ...
62 views

### Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...
44 views

### Many time pad if cleartext contains arbitrary bytes

I understand the problem of reusing the same key in the one-time pad if the cleartext message only contains characters such as A-Z, a-z and spaces. But what if our cleartext is composed of arbitrary ...
51 views

### How are “string-messages” converted to “number-messages”?

Textbooks most of the time assume that a message, say "secret", is already represented in number format, say "8614" (just as an example!). But how exactly is this conversion achieved? I imagine it to ...
46 views

### Is inversion always cheap with Twisted Edwards curves?

I'm reading on Jubjub, which is planned for the next upgrade of Zcash. It is based on a Twisted Edwards curve with parameters $a = -1$ and $d = −(10240/10241)$. The reading says Jubjub does not need ...
44 views

### What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

In DSA, the value of $r$ is generated as: $r = (g^k \bmod p) \bmod q$ ECDSA is similar, using the $x$ coordinate of the generator $g$ scalar-multiplied by $k$, again taken modulo $q$. It's well-...
52 views

### What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...